GDPR learning by doing (3)